@usearazzo/runner 1.0.1-alpha.13 → 1.0.1-alpha.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usearazzo/runner",
-  "version": "1.0.1-alpha.13",
+  "version": "1.0.1-alpha.14",
   "description": "Runner for Arazzo Workflows.",
   "keywords": [
     "arazzo",
@@ -73,8 +73,8 @@
     "@swaggerexpert/json-pointer": "^3.0.2",
     "@swaggerexpert/jsonpath": "^4.0.5",
     "@swaggerexpert/media-types": "^1.0.1",
-    "@usearazzo/parser": "1.0.1-alpha.13",
-    "@usearazzo/resolver": "1.0.1-alpha.13",
+    "@usearazzo/parser": "1.0.1-alpha.14",
+    "@usearazzo/resolver": "1.0.1-alpha.14",
     "@xmldom/xmldom": "^0.9.12",
     "fontoxpath": "^3.34.0",
     "ramda": "^0.32.0",
@@ -94,5 +94,5 @@
   "devDependencies": {
     "swagger-client": "^3.38.4"
   },
-  "gitHead": "41c018418a867e1469de0b2393929f7ec129c447"
+  "gitHead": "40a494596c0eed2f984fb87f544f3cf69488a6a7"
 }

package/src/document/ParameterIdentity.cjs

@@ -75,6 +75,14 @@ class ParameterIdentity {
     if (location === undefined || (0, _apidomDatamodel.isNullElement)(location)) return undefined;
     return (0, _apidomDatamodel.isStringElement)(location) ? (0, _apidomCore.toValue)(location) : null;
   }
+
+  /**
+   * The locations the Parameter Object defines: Arazzo 1.0.1's closed set plus
+   * 1.1.0's `querystring`. 1.0.0's field description also listed `body`, which
+   * its own summary of locations did not; 1.0.1 removed it as an erratum, so it
+   * is not a location in any version (a payload is the step's `requestBody`).
+   */
+  static LOCATIONS = ['path', 'query', 'header', 'cookie', 'querystring'];
   name;
   location;
   constructor(name, location) {
@@ -82,6 +90,14 @@ class ParameterIdentity {
     this.location = location;
   }
 
+  /**
+   * Whether the location is one the Parameter Object defines. An absent or
+   * malformed location is not.
+   */
+  get hasDefinedLocation() {
+    return ParameterIdentity.LOCATIONS.includes(this.location);
+  }
+
   /**
    * Whether this and the other identity name the same parameter. A malformed
    * location equals nothing, its own duplicate included.

package/src/document/ParameterIdentity.mjs

@@ -70,6 +70,14 @@ class ParameterIdentity {
     if (location === undefined || isNullElement(location)) return undefined;
     return isStringElement(location) ? toValue(location) : null;
   }
+
+  /**
+   * The locations the Parameter Object defines: Arazzo 1.0.1's closed set plus
+   * 1.1.0's `querystring`. 1.0.0's field description also listed `body`, which
+   * its own summary of locations did not; 1.0.1 removed it as an erratum, so it
+   * is not a location in any version (a payload is the step's `requestBody`).
+   */
+  static LOCATIONS = ['path', 'query', 'header', 'cookie', 'querystring'];
   name;
   location;
   constructor(name, location) {
@@ -77,6 +85,14 @@ class ParameterIdentity {
     this.location = location;
   }
 
+  /**
+   * Whether the location is one the Parameter Object defines. An absent or
+   * malformed location is not.
+   */
+  get hasDefinedLocation() {
+    return ParameterIdentity.LOCATIONS.includes(this.location);
+  }
+
   /**
    * Whether this and the other identity name the same parameter. A malformed
    * location equals nothing, its own duplicate included.

package/src/resolver/OpenAPIOperationParameterResolver.cjs

@@ -35,7 +35,11 @@ var _StepParameterResolver = _interopRequireDefault(require("./StepParameterReso
  * instead would let it capture *every* declared location of that name — see
  * `ParameterDelivery` for the lookup order that makes it so. A
  * non-string location throws for the same reason it deduplicates with nothing
- * in the normalizer: it names no location. And two *different* parameters the
+ * in the normalizer: it names no location. So does a location outside
+ * `path`, `query`, `header`, `cookie` and `querystring`: Arazzo 1.0.1 removed
+ * `in: body`, and forwarding one would let it still deliver a request body
+ * against an OpenAPI 2.0 operation, bypassing the step's `requestBody`, while
+ * an unknown location reaches nothing at all. And two *different* parameters the
  * map reports as colliding cannot both be delivered, so a collision throws
  * rather than silently dropping one — whether they collide on one key (the
  * scheme is not injective: a `querystring` parameter named `header.token` and
@@ -96,6 +100,13 @@ class OpenAPIOperationParameterResolver extends _StepParameterResolver.default {
           reason: 'malformed-location'
         });
       }
+      if (!identity.hasDefinedLocation) {
+        throw new _ResolverError.default(`Parameter "${name}" has location "${location}", which is not one of ` + `${_ParameterIdentity.default.LOCATIONS.join(', ')}`, {
+          ...scope,
+          target: name,
+          reason: 'invalid-location'
+        });
+      }
       const {
         key,
         outcome

package/src/resolver/OpenAPIOperationParameterResolver.mjs

@@ -28,7 +28,11 @@ import StepParameterResolver from "./StepParameterResolver.mjs";
  * instead would let it capture *every* declared location of that name — see
  * `ParameterDelivery` for the lookup order that makes it so. A
  * non-string location throws for the same reason it deduplicates with nothing
- * in the normalizer: it names no location. And two *different* parameters the
+ * in the normalizer: it names no location. So does a location outside
+ * `path`, `query`, `header`, `cookie` and `querystring`: Arazzo 1.0.1 removed
+ * `in: body`, and forwarding one would let it still deliver a request body
+ * against an OpenAPI 2.0 operation, bypassing the step's `requestBody`, while
+ * an unknown location reaches nothing at all. And two *different* parameters the
  * map reports as colliding cannot both be delivered, so a collision throws
  * rather than silently dropping one — whether they collide on one key (the
  * scheme is not injective: a `querystring` parameter named `header.token` and
@@ -89,6 +93,13 @@ class OpenAPIOperationParameterResolver extends StepParameterResolver {
           reason: 'malformed-location'
         });
       }
+      if (!identity.hasDefinedLocation) {
+        throw new ResolverError(`Parameter "${name}" has location "${location}", which is not one of ` + `${ParameterIdentity.LOCATIONS.join(', ')}`, {
+          ...scope,
+          target: name,
+          reason: 'invalid-location'
+        });
+      }
       const {
         key,
         outcome

package/types/runner.d.ts

@@ -1196,7 +1196,11 @@ export declare interface OpenAPIOperationNormalizerOptions {
  * instead would let it capture *every* declared location of that name — see
  * `ParameterDelivery` for the lookup order that makes it so. A
  * non-string location throws for the same reason it deduplicates with nothing
- * in the normalizer: it names no location. And two *different* parameters the
+ * in the normalizer: it names no location. So does a location outside
+ * `path`, `query`, `header`, `cookie` and `querystring`: Arazzo 1.0.1 removed
+ * `in: body`, and forwarding one would let it still deliver a request body
+ * against an OpenAPI 2.0 operation, bypassing the step's `requestBody`, while
+ * an unknown location reaches nothing at all. And two *different* parameters the
  * map reports as colliding cannot both be delivered, so a collision throws
  * rather than silently dropping one — whether they collide on one key (the
  * scheme is not injective: a `querystring` parameter named `header.token` and